Run the ping ladder and read what each rung means

short · 45 min · Objective 5.5

Task

Learn the diagnostic sequence that isolates a connectivity fault in five ordered tests, and pair it with the two commands that finish the job — dig to separate a name problem from a connectivity one, and netstat to confirm a service is listening. The skill the objective tests is knowing what each command's failure tells you, not just what it does.

Steps

  1. Rung one — the stack. ping -c1 127.0.0.1. A reply means the TCP/IP stack on this host works. A failure here is the host itself, before any network.
  2. Rung two — the interface. ping -c1 192.168.10.10 (Host A's own address). A reply means the interface is configured and up.
  3. Rung three — the local network. ping -c1 192.168.10.1 (the gateway). A reply means layers 1 to 3 across the local wire are healthy. Whichever rung first fails is where to look — the ladder localises the fault by construction.
  4. Rung four and five — routing and DNS. Ping an off-subnet address by IP (routing), then by name (DNS). If the name fails but the IP works, it is DNS — confirm with dig +short <name> @192.168.10.1, which queries the resolver directly and separates a name-resolution fault from a connectivity one.
  5. Confirm a service. On the target, netstat -tlnp (or ss -tlnp) shows whether anything is listening on the expected port. "Connection refused" with nothing listening means the service is the problem, not the network.

Verify

ping -c 1 -W 2 192.168.10.1; echo "gateway exit $?"
dig +short router.lab @192.168.10.1; echo "resolver exit $?"
ss -tlnp 2>/dev/null | grep -E ":22|:53|:80" || sudo netstat -tlnp | grep -E ":22|:53|:80"

Each command answers one question with an exit code or a line of output: the gateway ping settles the local network, the dig settles whether the resolver answers, and the listening-socket line settles whether the service is even up. Read together they place any fault on a specific rung rather than leaving it as "the network is down".

Notes

The reason to memorise the ladder is that it turns a vague outage into a location in four or five seconds of typing. A failed ping is not proof a host is down — ICMP is very commonly filtered on servers and firewalls — so read the message: "destination host unreachable" is a router saying it has no route (a routing problem, more informative than a timeout), while "TTL expired in transit" usually means a routing loop.

Two more tools finish the objective. traceroute/tracert shows where the path breaks — asterisks all the way to the end mean a real break, whereas asterisks at one hop with later hops responding is just a router declining to reply, which is normal. nmap discovers hosts and open ports and is invaluable for confirming a firewall rule does what it claims — on networks you are authorised to scan, which on this exercise means only the lab VMs you built.